Protection of a computer or data network from undesired and unauthorized data disclosure, interception or alteration has been a perennial concern in the field of computer and network security. For example, firewall and anti-spyware software have been developed to address security concerns for computers and networks connected to the Internet and to protect them from possible cyber-attacks such as Trojan horse-type viruses or worms that may trigger undesired and unauthorized data disclosure by these computers and networks. However, for high security computer networks such as those used by government agencies and intelligence community and certain commercial applications, conventional network security devices such as firewalls may not provide sufficiently reliable protection from undesired data disclosure.
Alternative network security methods and devices based on unidirectional data transfer have been devised to address the network security concern. For example, U.S. Pat. No. 5,703,562 to Nilsen (“the '562 patent”), the content of which is hereby incorporated by reference in its entirety, provides an alternative way to address the network security concern. The '562 patent discloses a method of transferring data from an unsecured computer to a secured computer over a one-way optical data link comprising an optical transmitter on the sending side and an optical receiver on the receiving side. By providing such an inherently unidirectional data link to a computer/data network to be protected, one can eliminate any possibility of unintended data leakage out of the computer/data network over the same link.
Any data link that strictly enforces the unidirectionality of data flow is called a one-way link or one-way data link. In other words, in such links it is physically impossible to send information or data of any kind in the reverse direction. One-way data link may be hardware-based, software-based, or based on some combination of hardware and software.
One-way data transfer systems based on such one-way data links provide network security to data networks by isolating the networks from potential security breaches (i.e., undesired and unauthorized data flow out of the secure network) while still allowing them to import data from the external source in a controlled fashion. FIG. 1 schematically illustrates an example of one such one-way data transfer system 100. In the one-way data transfer system shown in FIG. 1, two computing platforms 101 and 102 (respectively, “the send platform” and “the receive platform”) are connected to the unsecured external network 104 (“the source network”) and the secure network 105 (“the destination network”), respectively. The send platform 101 is connected to the receive platform 102 by a one-way data link 103, which may be an optical link comprising, for example, a high-bandwidth optical fiber. This one-way optical data link 103 may be configured to operate as a unidirectional data gateway from the source network 104 to the secure destination network 105 by having its ends connected to an optical transmitter on the send platform and to an optical receiver on the receive platform.
A configuration such as the one shown in FIG. 1 physically enforces one-way data transfer at both ends of the optical fiber connecting the send platform 101 to the receive platform 102, thereby creating a truly unidirectional data transfer link between the source network 104 and the destination network 105. One-way data transfer systems based on a one-way data link are designed to transfer data or information in only one direction, making it physically impossible to transfer any kind of data, such as handshaking protocols, error messages, or busy signals, in the reverse direction. Such physically imposed unidirectionality in data flow cannot be hacked by a programmer, as is often done with firewalls. Accordingly, the one-way data transfer system based on a one-way data link ensures that data residing on the isolated secure computer or network is maximally protected from any undesired and unauthorized disclosure.
It has been found desirable to collect real-time screen images from a server screen in one network and display them on a client screen in another network in a secure manner, i.e., while maintaining the sanctity of the first network. Thus, it is an object of the present invention to facilitate collection of real-time screen images from the server platform in segregated networks and their transfer across a one-way data link to be displayed on the client platform without compromising the security of the segregated networks.
In a one-way data transfer configuration, which strictly enforces the unidirectionality of data flow from a server to a client, the client platform cannot provide any feedback or warning signal to the server platform. This could be problematic in the event of an overflow condition at the input buffer of the client platform: If the rate at which screen image data is collected and transmitted from the server platform to the client platform via a one-way data link is higher than the rate at which such data can be processed and displayed by the client platform, this would lead to an overflow condition at the client platform. However, the server platform cannot be made aware of this condition at the client platform and continues to transmit the screen image data to the client platform at the same rate. Hence, it is an object of the present invention to provide a way for the client platform to resolve, by itself, the potential overflow condition at its input buffer without sacrificing the display quality or the security of the segregated networks.
Other objects and advantages of the present invention will become apparent from the following description.